<html>
<head>
<title>Use closures to keep a reference to an iframe and see if we can trick same origin policy.</title>
<script type="text/javascript" src="/shared/scripts/testcase.js"></script>
<script type="text/javascript">
if (window.addEventListener) {
	window.addEventListener('load', f, false);
} else if (window.attachEvent) {
	window.attachEvent('onload', f);
} else {
	window.onload = f;
}

// this will setup the iframe to flip 
function get_content_win(ifr, tc) {
	
	setTimeout((function () { ifr.src = 'http://victim.com/forbidden.html'; } ), 500);
	return (function() {
		return ifr.contentWindow.document.body.innerHTML;
	});
}
function f() {
	var tc = new TestCase();
	tc.input = 'f() { ifr.src = "victim.com"; return (function() { return ifr; }); }';
	tc.description = 'Use closures to keep a reference to an iframe and see if we can trick same origin policy.';
	tc.expected_result = "undefined or exception occurred";
	tc.output += 'SAME ORIGIN\n';
	try {
		var ifr = document.getElementById('ifr');
		var closure = get_content_win(ifr, tc); // will trigger the iframe's location to change.
		var same_origin = closure();
		tc.output += same_origin + '\n';
	} catch(e) {
		tc.output += 'exception occurred: ' + tc.outputException(e);
		tc.result = 'exception occurred';
		tc.test_passed = 'true';
		tc.saveTest();
		return;
	}
	tc.output += 'AFTER CLOSURE CALL\n';
	try {
		// let some time pass for the location of the ifr to flip
		setTimeout((function results() { callback_func(tc, closure);}), 1500);
	} catch(e) {
		// this should really never be called.
		tc.result = 'exception occurred';
		tc.output += 'exception occurred: ' + tc.outputException(e);
		tc.test_passed = 'true';
		tc.saveTest();
	}
}

function callback_func(tc, closure) {
	
	try {
		var result = closure();
		tc.output += result + '\n';
		if (result == undefined) {
			tc.test_passed = 'true';
			tc.result = 'undefined';
		} else {
			tc.result = 'properties accessible';
			tc.test_passed = 'false'; 
		}
	} catch(e) {
		tc.result = 'exception occurred';
		tc.output += 'exception occurred: ' + tc.outputException(e);
		tc.test_passed = 'true';
	}
	tc.saveTest(); 
}
</script>
</head>
<body>
	<iframe id="ifr" src="/allowed.html"></iframe>
</body>
</html>